QSN-8825-1: Requests vulnerability
2026-09-28

Summary:
Requests could be made to crash or run programs as your login if it
opened a specially crafted file.

Details:
It was discovered that Requests did not correctly handle generating
random temporary file paths. An attacker could possibly use this issue
to execute arbitrary code.

Affected QuantaStor releases:
  6.9.1.001 jammy: python3-requests 2.25.1+dfsg-2ubuntu0.4 (fixed in 2.25.1+dfsg-2ubuntu0.4)
  6.9.0.464 jammy: python3-requests 2.25.1+dfsg-2ubuntu0.4 (fixed in 2.25.1+dfsg-2ubuntu0.4)
  6.8.6.015 jammy: python3-requests 2.25.1+dfsg-2ubuntu0.3 (fixed in 2.25.1+dfsg-2ubuntu0.4)
  6.8.5.018 jammy: python3-requests 2.25.1+dfsg-2ubuntu0.3 (fixed in 2.25.1+dfsg-2ubuntu0.4)
  6.8.4.038 jammy: python3-requests 2.25.1+dfsg-2ubuntu0.3 (fixed in 2.25.1+dfsg-2ubuntu0.4)
  6.8.3.018 jammy: python3-requests 2.25.1+dfsg-2ubuntu0.3 (fixed in 2.25.1+dfsg-2ubuntu0.4)
  6.8.2.002 jammy: python3-requests 2.25.1+dfsg-2ubuntu0.3 (fixed in 2.25.1+dfsg-2ubuntu0.4)
  6.8.1.007 jammy: python3-requests 2.25.1+dfsg-2ubuntu0.3 (fixed in 2.25.1+dfsg-2ubuntu0.4)
  6.8.0.205 jammy: python3-requests 2.25.1+dfsg-2ubuntu0.3 (fixed in 2.25.1+dfsg-2ubuntu0.4)

CVEs: CVE-2026-25645

References:
  https://ubuntu.com/security/notices/USN-8825-1